CVE-2017-17087

What it actually does

In Vim versions before 8.0.1263, when creating a swap file (.swp), the group ownership is set to the editor's primary group instead of preserving the original file's group ownership. This can expose sensitive files' contents to unintended group members if permissions allow read access.

Why it matters to the business

Local users with group membership matching the editor's primary group may gain unauthorized access to sensitive information, such as password files, potentially leading to privilege escalation or data breaches on shared systems.

How an attack unfolds

An attacker with local access edits a sensitive file using Vim as a user whose primary group differs from the file's group. The resulting swap file inherits the editor's group, allowing the attacker to read the swap file's contents which mirror the sensitive data.

How to fix it

Upgrade Vim to a version containing commit 5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 or later. Ensure swap files are created with appropriate group ownership or disable swap files for sensitive operations.

How to confirm the fix worked

Verify Vim version is 8.0.1263 or higher. Test by editing a file with group ownership different from the user's primary group and checking the .swp file's group.

Typical attack path

1. Gain local user access on the system
2. Identify sensitive files with restrictive group permissions
3. Edit the file using Vim under a user with a different primary group
4. Access the .swp file to read the sensitive content

How to detect it

Examine system logs for Vim usage on sensitive files and check for .swp files with unexpected group ownership in directories containing critical files.

What your security team should do

• Update Vim installations to the fixed version immediately
• Review and restrict local access to systems handling sensitive files
• Consider using alternative editors or configurations that preserve file ownership for administrative tasks